tyler.durden
/
lynis
mirror of https://github.com/CISOfy/lynis.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Added FIRE-4586

This commit is contained in:
Michael Boelen 2017-01-28 15:46:42 +01:00
parent 7e5af7ae9c
commit 103ed2afb3
2 changed files with 18 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
db/tests.db
View File

@ -139,6 +139,7 @@ FIRE-4534:test:security:firewalls:MacOS:Check Little Snitch firewall:
FIRE-4536:test:security:firewalls:Linux:Check nftables status:
FIRE-4538:test:security:firewalls:Linux:Check nftables basic configuration:
FIRE-4540:test:security:firewalls:Linux:Test for empty nftables configuration:
FIRE-4586:test:security:firewalls::Check firewall logging:
FIRE-4590:test:security:firewalls::Check firewall status:
HOME-9302:test:security:homedirs::Create list with home directories:
HOME-9310:test:security:homedirs::Checking for suspicious shell history files:

17
include/tests_firewalls
View File

@ -453,6 +453,23 @@
# Check for specific features in nftables releases
#
#################################################################################
#
# Test : FIRE-4586
# Description : Check firewall logging
if [ ${FIREWALL_ACTIVE} -eq 1 ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
Register --test-no FIRE-4586 --preqs-met ${PREQS_MET} --weight L --network NO --root-only YES --category security --description "Check firewall logging"
if [ ${SKIPTEST} -eq 0 ]; then
if [ ${IPTABLES_ACTIVE} -eq 1 ]; then
if [ ! -z "${IPTABLESSAVEBINARY}" ]; then
HAS_LOGGING=$(${IPTABLESSAVEBINARY} | ${GREPBINARY} "-j LOG")
if [ -z "${HAS_LOGGING}" ]; then
Report "firewall_no_logging[]=iptables"
fi
fi
fi
fi
#
#################################################################################
#
# Test : FIRE-4590
# Description : Check if at least one firewall if active